The word WatchFile: is triggered when the specified file appears (is
created) or when its contents is modified.
If the specified file exists at the moment of nnCron startup, the task will
be started if the file has been changed since the moment when nnCron was unloaded
from memory.

The word WatchFileDelete: is triggered when the specified file is
deleted (renamed, moved).

Words WatchFile:/WatchFileDelete: can also work with filename masks,
but with one limitation: they looks for the first file in the specified directory
that matches a mask, and tests just this one file for modification. In other
words, if a directory contains more than one file matching a specified mask,
WatchFile:/WatchFileDelete: may ignore the fact of creation/modification/deletion
of another file matching this mask.

Flag (optional):WatchSubtreeModifiers (optional):WATCH-CHANGE-ATTRIBUTES notify of changes to the attributes
WATCH-CHANGE-DIR-NAME notify of changes to the directory name
WATCH-CHANGE-FILE-NAME notify of changes to the file names within
directory
WATCH-CHANGE-LAST-WRITE notify of changes to the last modification
date (is triggered when new file is created, or existant file is changed,
but in not triggered when a file is deleted)
WATCH-CHANGE-SECURITY notify of changes to the access rights
WATCH-CHANGE-SIZE notify of changes to the size

This word is triggered by changes in a specified directory. The modifiers listed
above allow a user to specify very precisely which parameters should be watched
for changes.

Flag WatchSubtree instructs nnCron to monitor not only a specified
directory, but all of its subdirectories as well.

Directory, that does not exists can also be specified as an argument for a
word WatchDir:. In this case WatchDir: enters a loop, waiting
for specified directory to be created and triggers when directory becomes available.
Self-fetching variableMonitorDirTimeout
sets the time (in ms) between every loop iteration. The default MonitorDirTimeout
value is 60000 ms (60 seconds).

WatchConnect
WatchDisconnect

These words are triggered, respectively, by connecting to and disconnecting
from your ISP. WatchConnect is also triggered on nnCron startup if
an active remote connection exists at that moment.

These words only work in WinNT/2000/XP.

WatchClipboard: "text_pattern"

This word is triggered if the contents of Windows clipboard matches the specified
mask.

In text_pattern, you can use either a usual mask (containing characters
* and ?) or regular expressions
inside of forward slashes: /<regexp>/.

Examples:

\ will be triggered by any changes in the clipboard contents
WatchClipboard: "*"
\ will be triggered if a name of any executable file
\ (e.g. 'nncron.exe') is copied to the clipboard
WatchClipboard: "*.exe*"
\ will be triggered if a text containing some number
\ is copied to the clipboard
WatchClipboard: "/.*\d+.*/"

These words are triggered when a window whose title matches the specified pattern
is created (opened), activated or closed, respectively.

Example:

#( test_watchwin\ the task would be executed
\ if a window of Notepad is opened,
\ or if a window of Opera browser is
\ or if a window of Internet Explorer is closed
WatchWinCreate: "*Notepad"
WatchWinActivate: "Opera*"
WatchWinDestroy: "*Internet Explorer"
Action: \ ... performing some useful actions)#

Let's analyze this task. We have set a window title pattern (*white*)
to watch for. Now, if there appears a window with a title containing substring
"white", or if its title is changed in such a way that the new title
contains substring "white", word WatchWindow: will be triggered.
For example, WatchWindow: will be triggered if there appears a window
titled 'white.txt - Notepad'. WatchWindow: will be also triggered if
the title is changed into 'black_and_white.txt - Notepad' (for the new title
contains 'white'). If the title is changed to 'black.txt - Notepad', WatchWindow:
won't be triggered, for the new title does not contain the substring
we are watching for.

It follows, then, that if a window title is changed and the new title does
not contain the specified substring, WatchWindow: won't be triggered.
If the original title is restored (the one containing this substring), WatchWindow:
will be triggered again.

The word WatchDrive: is triggered when removable device is connected to your PC (at the moment when specified disk drive letter appears in My Computer folder) or when specified CD/DVD-ROM drive tray is closed.

The word WatchDriveRemove: is triggered when removable device is disconnected from your PC (at the moment when specified disk drive letter disappears from My Computer folder) or when disk is removed from the specified CD/DVD-ROM drive. WatchDriveRemove: is triggered also when closing empty CD/DVD-ROM drive tray, because the system reports, that there is no disk in specified drive.

Use the specified disk drive letter as an argument to the words WatchDrive:/WatchDriveRemove:.
If you want to work with all the inserted/removed drives, you can use * mask
as well. After WatchDrive:/WatchDriveRemove: words have
been used the
variable %DRIVE-LETTER% is
filled with a letter of currently inserted/removed drive.

Note, please: in order for these words to work
properly with CD/DVD-ROM drives, option Autorun must be set to on. In Windows NT/2000/XP
this option is toggled on/off in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom.

These words are triggered, respectively, by starting or stopping the process
specified in the argument. Please note that word WatchProc: (unlike
WatchProcStop:) cannot take process identifier (PID) as its
argument.

Example:

#( test_proc\ the task will be started both when the process "wget.exe" is started
\ and when it is ended "wget.exe"
WatchProc: "wget.exe"
WatchProcStop: "wget.exe"
Action: \ ... performing some useful actions)#

After words WatchProc:/WatchProcStop: have been used, variable %WATCH-PROC-ID%
will contain a string with process identifier (PID).

Flag (optional):WatchSubtreeModifiers (optional):REG-CHANGE-ATTRIBUTES notify of changes to the attributes
of the key, such as the security descriptor information.
REG-CHANGE-NAME notify of changes to the key name
REG-CHANGE-LAST-SET notify of changes to the key last modification
date
REG-CHANGE-SECURITY notify of changes to the key access rights

This word is triggered by changes in a specified Registry key. The modifiers
listed above allow a user to specify very precisely which parameters should
be watched for changes.

Flag WatchSubtree instructs nnCron to monitor not only a specified
Registry key, but all of its subkeys as well.

Examples:

\ monitoring all the changes of the key
WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test"
\ monitoring changes of access rights
WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test"
REG-CHANGE-SECURITY
\ monitoring changes of the key name and changes of the names
\ of all the subkeys
WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test"
WatchSubtree
REG-CHANGE-NAME
\ monitoring changes of the key name and changes of access rights
WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test"
REG-CHANGE-NAME
REG-CHANGE-SECURITY

WatchLogoff: "username_pattern"
WatchLogon: "username_pattern"

These words are triggered, respectively, when a user tries to log off (end
his session) or log on the local computer. They take as their arguments masks
of user names.

Examples:

WatchLogon: "vkondakov"
\ will be triggered when either user Admin or user Administrator log on the system
WatchLogon: "Admi*"
\ will be triggered when any user ends his session
WatchLogoff: "*"

WatchShutdown WatchSuspend

These words are triggered when computer is shutting down (WatchShutdown) or switching
to Hibernate or Standby modes (WatchSuspend). It should be noted that
nnCron has no means to stop or suspend the process of shutting the system down
or switching it to Hibernate mode when this process is already started, so that if a long task is started on such
an event, it may be interrupted before it is complete. Event specifiers WatchShutdown and WatchSuspend were created in order to be used in shorter tasks,
e.g. setting up a timer (for example, setting a period of time after which the computer
should wake up) or creating a flag file.

If you want to have a choice to intercept the shutdown process, watch the moment, when operating system is querying applications before shutting the computer down (WatchQueryShutdown).

This word is triggered when operating system is querying applications before shutting the computer down. You can use WatchQueryShutdown for example when you want to have a choice to intercept the computer shutdown process.

This word is triggered when applications are queried before
switching to Hibernate or Standby modes.

WatchBatteryLow

This word is triggered when the system sends a message that the batteries are low.

WatchResume
WatchResumeAuto

These words are triggered when the system returns to normal energy consuming
after being in Hibernate or Standby modes.

The word WatchResume is triggered, when the system returns to normal mode forced by some user activity (mouse moving or pressing of any key) - for example, after resuming from StandBy mode and when user activity is detected after resuming from Hibernate mode.WatchResumeAuto is triggered, when the system returns to normal working mode after being in Hibernate or Standby modes regardless of presence or lack of user activity.

Examples:

#( test_watchresume\ will be triggered after resuming from StandBy
\ and when user activity will be first detected
\ after resuming from Hibernate
WatchResume
Action:
BEEP: 50 500
PAUSE: 100
BEEP: 50 500
)#
#( test_watchresumeauto\ will be triggered after resuming from StandBy
\ and after resuming from Hibernate
WatchResumeAuto
Action:
BEEP: 50 500
PAUSE: 100
BEEP: 50 500
)#
#( test_watchresumecombined
\ will be triggered once after resuming from StandBy
\ and twice after resuming from Hibernate (right after
\ resuming and when user activity will be first detected)
WatchResume
WatchResumeAuto
Action:
BEEP: 50 500
PAUSE: 100
BEEP: 50 500
)#

WatchHotKey: "hotkey"

This word is triggered by pressing a specified "hotkey" (keyboard
shortcut), consisting of one or more keys pressed together. It may be advisable
to create hotkeys by combining such keys as CTRL, SHIFT, ALT
or WIN with one of the alphanumerical keys. If a shortcut consists
of two or more keys, they are considered to be pressed simultaneously. The order
of keys and case of alphabetical keys does not matter (^@w è @W^
are the same thing).
A detailed description of symbolic designations of various keys can be found
here.

A special set of watch-words to work with Windows Terminal Services (WTS). These words are triggered when the respective event happens. Here is a brief description of these events:

WTS_CONSOLE_CONNECT A session was connected to the console session.
WTS_CONSOLE_DISCONNECT A session was disconnected from the console session.
WTS_REMOTE_CONNECT A session was connected to the remote session.
WTS_REMOTE_DISCONNECT A session was disconnected from the remote session.
WTS_SESSION_LOGON A user has logged on to the session.
WTS_SESSION_LOGOFF A user has logged off the session.
WTS_SESSION_LOCK A session has been locked.
WTS_SESSION_UNLOCK A session has been unlocked

After WTSWatch* words have been used, variable WATCH-SESSIONID will contain a SessionID number.

Note: Words of WatchWin*:
group ignore console windows. This limitation is imposed by the operating system.
At the same time, word WIN-EXIST:
can work correctly with both with normal and console windows. Therefore, you
can attempt to monitor console windows with the help periodical use of WIN-EXIST:.